evolcore 0.0.20 → 0.0.22

package/dist/utils/atomic-write.js

@@ -75,6 +75,33 @@ export function atomicWrite(filePath, content) {
 export function atomicWriteJson(filePath, value) {
     atomicWrite(filePath, JSON.stringify(value, null, 2) + '\n');
 }
+/**
+ * Update a small protected file without replacing its directory entry.
+ *
+ * H-class sandbox mounts bind individual files by pathname. Replacing such a
+ * file with rename(2) changes the inode while bubblewrap is constructing its
+ * mount table and can make the bind/remount operation fail. This helper keeps
+ * the inode stable; callers should use it only for best-effort, daemon-owned
+ * state where a crash during the write may leave incomplete content.
+ */
+export function stableWrite(filePath, content) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const noFollow = fs.constants.O_NOFOLLOW ?? 0;
+    const fd = fs.openSync(filePath, fs.constants.O_RDWR | fs.constants.O_CREAT | noFollow, 0o600);
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error(`stable write target is not a regular file: ${filePath}`);
+        fs.ftruncateSync(fd, 0);
+        fs.writeFileSync(fd, content, 'utf8');
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function stableWriteJson(filePath, value) {
+    stableWrite(filePath, JSON.stringify(value, null, 2) + '\n');
+}
 /**
  * 原子读取——自动按状态恢复。文件不存在时返回 null。
  *

package/dist/utils/ecweb-utils.js

@@ -3,6 +3,7 @@ import path from 'path';
 import { compareVersions, resolveGlobalPkg } from './npm-ops.js';
 import { isWindows as platformIsWindows, resolveCommandPath } from './cross-platform.js';
 import { MIN_ECWEB_VERSION, WEB_CLI_BIN, WEB_PACKAGE_NAME } from '../product.js';
+import { resolvePaths } from '../paths.js';
 /** EC Web owns the session-log reader, so older builds cannot safely serve a newer daemon. */
 export function isEcwebVersionSupported(version) {
     const normalized = version?.trim();
@@ -70,10 +71,23 @@ export function resolveEcwebLaunchCommand(ecwebArgs, opts = {}) {
  * 配对码是 ecweb 进程自己生成并持有的内部状态。daemon/CLI 通过 ecweb 的
  * localhost-only HTTP 接口 GET /api/pair-code 取当前码（远程访问被 ecweb 403 拒绝）。
  */
-/** 经 localhost 拉取 ecweb 当前配对码（仅本机可取）。失败返回 null。 */
-export async function fetchEcwebPairCode(port) {
+/** 经 localhost 拉取 ecweb 当前配对码（仅本机可取）。失败返回 null。
+ * authorizedBy 仅由 daemon 的 AUN 控制通道传入，用于把配对码换出的 token
+ * 绑定到实际批准的 daemon-owner；普通 CLI 取码不携带该字段。 */
+export async function fetchEcwebPairCode(port, authorizedBy) {
     try {
+        const headers = {};
+        const owner = authorizedBy?.trim();
+        if (owner)
+            headers['x-evolcore-pair-authorized-by'] = owner;
+        try {
+            const controlToken = fs.readFileSync(resolvePaths().controlToken, 'utf8').trim();
+            if (controlToken)
+                headers['x-evolcore-control-token'] = controlToken;
+        }
+        catch { }
         const resp = await fetch(`http://127.0.0.1:${port}/api/pair-code`, {
+            headers,
             signal: AbortSignal.timeout(2000),
         });
         if (!resp.ok)

package/dist/utils/error-utils.js

@@ -388,7 +388,10 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
     const warnPrefix = includeEmoji ? '⚠️ ' : '';
     const errPrefix = includeEmoji ? '❌ ' : '';
     if (msg.includes('CONTEXT_COMPACT_FAILED') || isContextTooLongText(msg)) {
-        return `${warnPrefix}上下文过长，自动压缩失败，请手动输入 /compact 重试`;
+        const detail = msg.match(/^CONTEXT_COMPACT_FAILED:\s*(.+)$/)?.[1]?.trim();
+        return detail
+            ? `${warnPrefix}上下文过长，自动压缩失败：${detail}`
+            : `${warnPrefix}上下文过长，自动压缩失败，请手动输入 /compact 重试`;
     }
     if (isSandboxInitializationFailure(error)) {
         return `${warnPrefix}只读执行沙箱启动失败（sandbox_initialization_failed），当前任务未执行；请检查 user namespace/seccomp 配置后重试`;

package/dist/utils/logger.js

@@ -1,7 +1,8 @@
 import fs from 'fs';
 import { resolvePaths } from '../paths.js';
 import { LogWriter } from './log-writer.js';
-import { classifyToolErrorCode } from '../core/permission/tool-error-code.js';
+import { classifyToolErrorCode, normalizeToolErrorCode } from '../core/permission/tool-error-code.js';
+import { normalizePermissionMode } from '../core/permission/mode.js';
 import { buildToolLifecycleEventKey } from '../core/audit/event-key.js';
 let currentLevel = process.env.LOG_LEVEL || 'INFO';
 const LEVELS = { DEBUG: 0, INFO: 1, WARN: 2, ERROR: 3 };
@@ -70,15 +71,32 @@ export function normalizeStructuredLog(data) {
         ?? nested?.toolUseId
         ?? nested?.tool_use_id;
     const sessionId = data.sessionId ?? data.session_id ?? nested?.sessionId ?? nested?.session_id;
-    const agentAid = data.agentAid ?? data.agent_aid ?? data.selfAid ?? nested?.agentAid ?? nested?.agent_aid;
-    const permissionMode = data.permissionMode ?? data.permission_mode ?? nested?.permissionMode ?? nested?.permission_mode;
+    const agentAid = data.agentAid ?? data.agent_aid ?? data.selfAid ?? nested?.agentAid ?? nested?.agent_aid ?? nested?.selfAid;
+    const rawAgentName = data.agentName ?? data.agent_name ?? nested?.agentName ?? nested?.agent_name;
+    // Lifecycle streams should carry both the stable AID and a display label.
+    // When a producer only knows the AID, use that same value as the label so
+    // daily joins never invent a second identity for one session.
+    const normalizedAgentName = typeof rawAgentName === 'string' ? rawAgentName.trim() : '';
+    const agentName = normalizedAgentName
+        && !['unknown', '<unknown>', '<none>', 'undefined', 'null'].includes(normalizedAgentName)
+        ? normalizedAgentName
+        : typeof agentAid === 'string' && agentAid !== 'unknown'
+            ? agentAid
+            : undefined;
+    const rawPermissionMode = data.permissionMode ?? data.permission_mode ?? nested?.permissionMode ?? nested?.permission_mode;
+    // Normalize legacy values at the log boundary. Preserve an explicit
+    // `unknown` marker for records that genuinely arrived without context.
+    const permissionMode = typeof rawPermissionMode === 'string'
+        && rawPermissionMode !== 'unknown'
+        ? normalizePermissionMode(rawPermissionMode).mode
+        : rawPermissionMode;
     const toolName = data.toolName ?? data.tool ?? data.name ?? nested?.toolName ?? nested?.name;
     const isToolResult = eventType === 'tool:result' || eventType === 'tool_result';
     const isToolUse = eventType === 'tool:use' || eventType === 'tool_use';
     const isError = data.isError ?? data.is_error ?? (data.ok === false ? true : undefined)
         ?? nested?.isError ?? nested?.is_error ?? (nested?.ok === false ? true : undefined);
-    const error = data.error ?? data.errorMessage ?? nested?.error ?? nested?.errorMessage;
-    const result = data.result ?? data.content ?? nested?.result ?? nested?.content;
+    const decisionSource = data.decisionSource ?? data.decision_source
+        ?? nested?.decisionSource ?? nested?.decision_source;
     const decision = data.decision
         ?? data.status
         ?? (isToolResult && isError === true ? 'error' : undefined)
@@ -95,8 +113,11 @@ export function normalizeStructuredLog(data) {
         ?? nested?.errorCode
         ?? nested?.error_code;
     const errorCode = isToolResult && isError === true
-        ? classifyToolErrorCode({ errorCode: explicitErrorCode, error, result })
+        ? classifyToolErrorCode({ errorCode: explicitErrorCode, decisionSource })
         : explicitErrorCode;
+    const classificationMissing = isToolResult && isError === true
+        && !normalizeToolErrorCode(explicitErrorCode)
+        && decisionSource !== 'policy' && decisionSource !== 'approval';
     const lifecycleRecord = isToolUse || isToolResult;
     const lifecycleEventKey = lifecycleRecord
         ? (eventKey ?? buildToolLifecycleEventKey({
@@ -116,12 +137,15 @@ export function normalizeStructuredLog(data) {
         ...(correlationId ? { correlationId } : {}),
         ...(sessionId ? { sessionId } : lifecycleRecord ? { sessionId: 'unknown' } : {}),
         ...(agentAid ? { agentAid } : lifecycleRecord ? { agentAid: 'unknown' } : {}),
+        ...(agentName ? { agentName } : lifecycleRecord ? { agentName: 'unknown' } : {}),
         ...(permissionMode ? { permissionMode } : lifecycleRecord ? { permissionMode: 'unknown' } : {}),
         ...(toolName ? { toolName } : {}),
+        ...(decisionSource ? { decisionSource } : {}),
         ...(decision ? { decision } : {}),
         ...(executed !== undefined ? { executed } : {}),
         ...(executionState ? { executionState } : {}),
         ...(errorCode ? { errorCode } : {}),
+        ...(classificationMissing ? { classificationMissing: true } : {}),
         ...(missingContextFields.length > 0 ? { contextMissing: missingContextFields } : {}),
     };
 }

package/dist/utils/process-tree-stats.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import { spawnSync } from 'child_process';
+import { parseCimDate } from './process-introspect.js';
 function runnerKind(name) {
     const normalized = name.toLowerCase();
     if (normalized.includes('codex'))
@@ -164,7 +165,7 @@ function readUnixPsMetrics() {
 function readWindowsMetrics() {
     const command = [
         'Get-CimInstance Win32_Process',
-        'Select-Object ProcessId,ParentProcessId,Name,WorkingSetSize,KernelModeTime,UserModeTime,CreationDate',
+        "Select-Object ProcessId,ParentProcessId,Name,WorkingSetSize,KernelModeTime,UserModeTime,@{Name='CreationDate';Expression={if ($_.CreationDate) {$_.CreationDate.ToUniversalTime().ToString('o')}}}",
         'ConvertTo-Json -Compress',
     ].join(' | ');
     const result = spawnSync('powershell', ['-NoProfile', '-Command', command], {
@@ -184,13 +185,32 @@ function readWindowsMetrics() {
             name: String(row.Name || 'unknown'),
             rss: Number(row.WorkingSetSize) || 0,
             cumulativeCpuMs: ((Number(row.KernelModeTime) || 0) + (Number(row.UserModeTime) || 0)) / 10_000,
-            startId: row.CreationDate ? String(row.CreationDate) : undefined,
+            // Keep a comparable numeric start time when PowerShell serializes CIM
+            // DateTime as either CIM text or an ISO date. The raw value remains as
+            // a fallback so PID reuse protection in ProcessTreeSampler still works
+            // when a platform returns an unfamiliar representation.
+            startId: parseWindowsCreationDate(row.CreationDate),
         })).filter((row) => row.pid > 0);
     }
     catch {
         return [];
     }
 }
+export function parseWindowsCreationDate(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const raw = String(value).trim();
+    if (!raw)
+        return undefined;
+    const cim = parseCimDate(raw);
+    if (cim !== null)
+        return cim;
+    const serializedDate = raw.match(/^\/Date\((-?\d+)(?:[+-]\d{4})?\)\/$/);
+    if (serializedDate)
+        return Number(serializedDate[1]);
+    const parsed = Date.parse(raw);
+    return Number.isFinite(parsed) ? parsed : raw;
+}
 export function readProcessMetrics() {
     if (process.platform === 'linux')
         return readLinuxMetrics();
@@ -209,9 +229,9 @@ export class ProcessTreeSampler {
         this.readMetrics = readMetrics;
         this.now = now;
     }
-    sample(associatedRootPids = []) {
+    sample(associatedRootPids = [], metricsOverride) {
         const timestamp = this.now();
-        const metrics = this.readMetrics();
+        const metrics = metricsOverride ?? this.readMetrics();
         const byPid = new Map(metrics.map(metric => [metric.pid, metric]));
         const children = new Map();
         for (const metric of metrics) {

package/dist/utils/process-tree-worker.js

@@ -0,0 +1,31 @@
+import { parentPort } from 'node:worker_threads';
+import { performance } from 'node:perf_hooks';
+import { readProcessMetrics } from './process-tree-stats.js';
+const port = parentPort;
+if (!port)
+    throw new Error('process-tree worker requires a parent port');
+port.on('message', (message) => {
+    if (message?.type !== 'sample')
+        return;
+    const startedAt = performance.now();
+    try {
+        const metrics = readProcessMetrics();
+        if (metrics.length === 0)
+            throw new Error('process enumeration returned no metrics');
+        const response = {
+            type: 'sample',
+            requestId: message.requestId,
+            metrics,
+            durationMs: Math.round((performance.now() - startedAt) * 10) / 10,
+        };
+        port.postMessage(response);
+    }
+    catch (error) {
+        port.postMessage({
+            type: 'sample-error',
+            requestId: message.requestId,
+            error: error instanceof Error ? error.message : String(error),
+            durationMs: Math.round((performance.now() - startedAt) * 10) / 10,
+        });
+    }
+});

package/dist/utils/project-path.js

@@ -53,8 +53,7 @@ export function defaultProjectsRoot(evolcoreRoot, options = {}) {
 export function agentProjectRootFromDefaults(defaults, evolcoreRoot, options = {}) {
     const platform = options.platform ?? process.platform;
     const pathImpl = pathForPlatform(platform);
-    const configuredRoot = defaults?.projects?.rootPath
-        || (defaults?.projects?.defaultPath && pathImpl.dirname(defaults.projects.defaultPath))
+    const configuredRoot = defaults?.projects?.defaultPath
         || defaultProjectsRoot(evolcoreRoot, options);
     return sanitizeProjectRoot(configuredRoot, options);
 }

package/dist/utils/tool-summary.js

@@ -5,6 +5,65 @@
  * Edit 工具的摘要为 diff 风格预览（支持 old/new_string 与 unified diff 两种输入）。
  */
 import fs from 'fs';
+import { parseLiteralShellArgv, resolveCodexShellCarrierString, } from '../core/permission/ec-command-parser.js';
+const DISPLAY_POSIX_SHELLS = new Set(['bash', 'sh']);
+const DISPLAY_POWERSHELLS = new Set(['pwsh', 'pwsh.exe', 'powershell', 'powershell.exe']);
+const DISPLAY_CMD_SHELLS = new Set(['cmd', 'cmd.exe']);
+const DISPLAY_CMD_INERT_SWITCHES = new Set(['/d', '/s', '/q', '/a', '/u']);
+function executableBasename(value) {
+    if (typeof value !== 'string')
+        return '';
+    return value.replaceAll('\\', '/').split('/').at(-1)?.toLowerCase() ?? '';
+}
+/** Display-only fallback for valid Codex carriers installed outside standard paths. */
+function summarizeDisplayCarrierArgv(argv) {
+    if (argv.length === 3) {
+        const executable = executableBasename(argv[0]);
+        const switchName = argv[1]?.toLowerCase();
+        if (DISPLAY_POSIX_SHELLS.has(executable) && switchName === '-lc')
+            return argv[2];
+        if (DISPLAY_POWERSHELLS.has(executable) && switchName === '-command')
+            return argv[2];
+    }
+    if (argv.length >= 3 && DISPLAY_CMD_SHELLS.has(executableBasename(argv[0]))) {
+        const executeIndex = argv.slice(1, -1).findIndex(value => value.toLowerCase() === '/c');
+        if (executeIndex >= 0 && executeIndex + 1 === argv.length - 2) {
+            const switches = argv.slice(1, executeIndex + 1);
+            if (switches.every(value => DISPLAY_CMD_INERT_SWITCHES.has(value.toLowerCase()))) {
+                return argv.at(-1);
+            }
+        }
+    }
+    return undefined;
+}
+/** Remove Codex app-server's fixed shell carrier from display-only arguments. */
+function displayShellCommand(command) {
+    if (typeof command !== 'string' || !command)
+        return undefined;
+    const parsedArgv = parseLiteralShellArgv(command);
+    const display = parsedArgv ? summarizeDisplayCarrierArgv(parsedArgv) : undefined;
+    if (display !== undefined)
+        return display;
+    // The nested PowerShell body is not POSIX shell syntax and can contain
+    // quotes, variables, redirects, and statement composition. Use the strict
+    // carrier parser only for PowerShell commands that the argv projection
+    // cannot parse; ordinary `bash -c` commands must remain unchanged.
+    const carrier = resolveCodexShellCarrierString(command);
+    return carrier?.dialect === 'powershell' ? carrier.command : undefined;
+}
+/**
+ * Build the tool arguments projected into activity/thought payloads.
+ * Execution, permission checks, and audit logging keep using the original
+ * input; only the human-facing Shell command is de-wrapped here.
+ */
+export function toolInputForDisplay(toolName, input) {
+    if (!input || toolName !== 'Shell')
+        return input;
+    const command = displayShellCommand(input.command);
+    if (!command || command === input.command)
+        return input;
+    return { ...input, command };
+}
 /**
  * 工具输入摘要（提取工具调用的可读描述，供权限审批和消息展示使用）
  */

package/dist/utils/windows-shell-trust.js

@@ -0,0 +1,201 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+const MAX_CACHE_ENTRIES = 128;
+const signatureCache = new Map();
+/**
+ * The signer name is checked only after Authenticode reports a trusted chain.
+ * Keep this list deliberately small: an unsigned or unknown Bash distribution
+ * must not enter the privileged EC command path.
+ */
+const MICROSOFT_PUBLISHER_RE = /(?:^|[,;]\s*)CN=Microsoft (?:Corporation|Windows(?: [^,;]+)?)(?:[,;]|$)/i;
+const MICROSOFT_ORG_RE = /(?:^|[,;]\s*)O=Microsoft Corporation(?:[,;]|$)/i;
+const BASH_PUBLISHER_RES = [
+    /(?:^|[,;]\s*)(?:CN|O)=Git for Windows(?:[,;]|$)/i,
+    /(?:^|[,;]\s*)(?:CN|O)=The Git Development Community(?:[,;]|$)/i,
+    // Git for Windows binaries are currently signed by project maintainer
+    // Johannes Schindelin rather than a certificate named after the project.
+    /(?:^|[,;]\s*)(?:CN|O)=Johannes Schindelin(?:[,;]|$)/i,
+    /(?:^|[,;]\s*)(?:CN|O)=Red Hat,? Inc\.(?:[,;]|$)/i,
+    /(?:^|[,;]\s*)(?:CN|O)=MSYS2(?:[,;]|$)/i,
+];
+function isValidStatus(status) {
+    return typeof status === 'string' && status.trim().toLowerCase() === 'valid';
+}
+/** Pure signature policy, separately testable without a Windows host. */
+export function isTrustedShellSignature(kind, evidence) {
+    if (!isValidStatus(evidence.status) || typeof evidence.subject !== 'string')
+        return false;
+    const subject = evidence.subject.trim();
+    if (kind === 'cmd' || kind === 'powershell') {
+        return MICROSOFT_PUBLISHER_RE.test(subject) && MICROSOFT_ORG_RE.test(subject);
+    }
+    return (MICROSOFT_PUBLISHER_RE.test(subject) && MICROSOFT_ORG_RE.test(subject))
+        || BASH_PUBLISHER_RES.some(pattern => pattern.test(subject));
+}
+function windowsSystemRoot() {
+    return process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+}
+function systemPowerShellPath() {
+    return path.win32.join(windowsSystemRoot(), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+function systemPowerShellModulePath() {
+    return path.win32.join(windowsSystemRoot(), 'System32', 'WindowsPowerShell', 'v1.0', 'Modules');
+}
+/**
+ * Windows PowerShell 5.1 must load its own Security module. A caller's
+ * PSModulePath can put PowerShell 7's module ahead of it; that module is not
+ * compatible with 5.1 and makes Get-AuthenticodeSignature fail to load.
+ */
+function systemPowerShellEnvironment() {
+    const env = { ...process.env };
+    for (const key of Object.keys(env)) {
+        if (key.toLowerCase() === 'psmodulepath')
+            delete env[key];
+    }
+    env.PSModulePath = systemPowerShellModulePath();
+    return env;
+}
+function systemWherePath() {
+    return path.win32.join(windowsSystemRoot(), 'System32', 'where.exe');
+}
+function isAbsoluteWindowsPath(value) {
+    return path.win32.isAbsolute(value) || /^\\\\[^\\/]+[\\/][^\\/]+/.test(value);
+}
+function resolveBareShellExecutable(executable, kind) {
+    const name = executable.toLowerCase().replace(/\.exe$/i, '');
+    if (kind === 'cmd' && name === 'cmd') {
+        return path.win32.join(windowsSystemRoot(), 'System32', 'cmd.exe');
+    }
+    if (kind === 'powershell' && name === 'powershell') {
+        return systemPowerShellPath();
+    }
+    const result = spawnSync(systemWherePath(), [`${name}.exe`], {
+        encoding: 'utf8',
+        timeout: 3000,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    if (result.status !== 0)
+        return undefined;
+    const first = String(result.stdout || '')
+        .split(/\r?\n/)
+        .map(line => line.trim())
+        .find(Boolean);
+    return first || undefined;
+}
+function resolveShellPath(executable, kind) {
+    if (!executable)
+        return undefined;
+    // Codex can keep its POSIX carrier spelling on Windows (for example
+    // `/bin/bash`). It is a logical shell name, not a Windows root-relative
+    // filesystem path, so resolve it through the trusted Windows PATH lookup.
+    if (executable.startsWith('/') && !executable.startsWith('//')) {
+        const basename = path.posix.basename(executable);
+        return resolveBareShellExecutable(basename, kind);
+    }
+    if (isAbsoluteWindowsPath(executable))
+        return executable;
+    return resolveBareShellExecutable(executable, kind);
+}
+function isAppExecutionAliasPath(value) {
+    return /[\\/]AppData[\\/]Local[\\/]Microsoft[\\/]WindowsApps[\\/]/i.test(value);
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function probeAuthenticode(filePath) {
+    const script = [
+        '$ErrorActionPreference = "Stop"',
+        `$p = ${shellQuote(filePath)}`,
+        '$item = Get-Item -LiteralPath $p -Force',
+        'if ($item.PSIsContainer) { exit 17 }',
+        '$sig = Get-AuthenticodeSignature -LiteralPath $item.FullName',
+        '[pscustomobject]@{',
+        '  status = [string]$sig.Status',
+        '  subject = if ($sig.SignerCertificate) { [string]$sig.SignerCertificate.Subject } else { "" }',
+        '  issuer = if ($sig.SignerCertificate) { [string]$sig.SignerCertificate.Issuer } else { "" }',
+        '} | ConvertTo-Json -Compress',
+    ].join('\n');
+    const result = spawnSync(systemPowerShellPath(), [
+        '-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script,
+    ], {
+        encoding: 'utf8',
+        env: systemPowerShellEnvironment(),
+        timeout: 5000,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    if (result.status !== 0 || result.error || !String(result.stdout || '').trim())
+        return undefined;
+    try {
+        const parsed = JSON.parse(String(result.stdout));
+        return {
+            status: typeof parsed.status === 'string' ? parsed.status : undefined,
+            subject: typeof parsed.subject === 'string' ? parsed.subject : undefined,
+            issuer: typeof parsed.issuer === 'string' ? parsed.issuer : undefined,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function cacheKey(filePath) {
+    try {
+        return fs.realpathSync.native(filePath).toLowerCase();
+    }
+    catch {
+        return filePath.replaceAll('\\', '/').toLowerCase();
+    }
+}
+/**
+ * Verify the concrete executable selected by Codex. Non-Windows callers keep
+ * the existing parser behavior; only Windows enters the Authenticode path.
+ */
+export function isTrustedWindowsShellExecutable(executable, kind) {
+    if (process.platform !== 'win32')
+        return true;
+    const resolved = resolveShellPath(executable, kind);
+    if (!resolved)
+        return false;
+    let finalPath = resolved;
+    try {
+        finalPath = fs.realpathSync.native(resolved);
+    }
+    catch {
+        // Keep the original path for the signature probe; the stat/probe below
+        // will fail closed if the executable is not accessible.
+    }
+    // If realpath could not escape an App Execution Alias, do not authenticate
+    // the alias stub itself. A resolved WindowsApps package binary is allowed
+    // and is checked below like any other signed executable.
+    if (isAppExecutionAliasPath(finalPath))
+        return false;
+    let stat;
+    try {
+        stat = fs.statSync(finalPath);
+        if (!stat.isFile())
+            return false;
+    }
+    catch {
+        return false;
+    }
+    const key = cacheKey(finalPath);
+    const previous = signatureCache.get(key);
+    if (previous && previous.size === stat.size && previous.mtimeMs === stat.mtimeMs) {
+        return previous.trusted;
+    }
+    const trusted = isTrustedShellSignature(kind, probeAuthenticode(finalPath) ?? {});
+    signatureCache.set(key, { size: stat.size, mtimeMs: stat.mtimeMs, trusted });
+    while (signatureCache.size > MAX_CACHE_ENTRIES) {
+        const oldest = signatureCache.keys().next().value;
+        if (!oldest)
+            break;
+        signatureCache.delete(oldest);
+    }
+    return trusted;
+}
+/** Test hook: clear cached signature decisions after a fixture is replaced. */
+export function clearWindowsShellTrustCache() {
+    signatureCache.clear();
+}

package/kits/docs/INDEX.md

@@ -25,7 +25,7 @@
 | 文档 | 路径 | 说明 |
 |------|------|------|
 | 命令集目录 | `evolcore/INDEX.md` | msg/group/agent/aid/storage/ctl/rpc/bench 全集索引 |
-| 联系人命令 | `evolcore/contact.md` | Contact Book 拉黑与托管会话权限边界 |
+| 联系人命令 | `evolcore/contact.md` | Contact Book 添加申请、拉黑与托管会话权限边界 |
 
 ## 身份
 

package/kits/docs/evolcore/INDEX.md

@@ -29,13 +29,13 @@
 | 命令集 | 用途 | 触发词 | 适用场景 | 文档 |
 |--------|------|--------|----------|------|
 | `ec msg` | 私聊收发消息 | 回复/发消息/拉取/撤回/查在线 | 有对端（peerId） | `msg.md` |
-| `ec group` | 群聊收发与群管理 | 群发/建群/邀请/踢人/退群/群成员/角色/封禁/规则 | 群聊（groupId） | `group.md` |
+| `ec group` | 群聊收发与群管理 | 群发/建群/邀请/踢人/退群/群成员/角色/封禁/规则/协作 | 群聊（groupId） | `group.md`；完整协作流程见 `group-collaboration.md` |
 | `ec group rules` | 群规则文件发布与上下文注入 | 群规则/工作流程/职责分工/rules.md/发布规则 | AUN 群聊（groupId） | `group-rules.md` |
 | `ec aid` | AID 身份管理 | 身份/证书/名片/探测对端 | 任意有渠道场景 | `aid.md` |
 | `ec fs` | AUN 文件系统统一入口 | 上传/下载/看文件/列目录/删文件/配额/群空间 | 任意有渠道场景 | `fs.md` |
 | `ec storage` | 文件存储底层调试入口 | storage 调试/旧命令/底层上传下载 | 任意有渠道场景 | `storage.md` |
-| `ec agent` | EvolAgent 生命周期 | 创建/启停/热重载/改配置 | 管理员（owner/admin） | `agent.md` |
-| `ec contact` | Contact Book 与访问控制 | 拉黑/解除拉黑/查拉黑 | 读 owner/admin；写仅 owner | `contact.md` |
+| `ec agent` | EvolAgent 生命周期 | 创建/启停/热重载/改配置 | 管理员（owner/admin） | `agent.md`；完整创建与 Bootstrap 见 `agent-create.md` |
+| `ec contact` | Contact Book 与访问控制 | 申请添加、拉黑/解除拉黑、查拉黑 | Agent 当前私聊可申请添加；管理写操作按角色限制 | `contact.md` |
 | `ec rpc` | 底层 AUN RPC（逃生通道） | 直接调协议方法 | 高级/兜底 | `rpc.md` |
 
 ## 会话自管理类（不连 AUN，操作当前会话）